DEBIAN-CVE-2024-21510

Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...

CVE-2024-21510

Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host XFH header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into...

SUSE CVE-2024-45410

Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modif...

Server-Side Request Forgery in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...

CVE-2024-21498

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...

CVE-2024-21498

CVE-2024-21498 : SSRF in the Go package github.com/greenpau/caddy-security across all versions, caused by manipulation of the X-Forwarded-Host header. Impact: attacker may access sensitive data or reach internal services. Remediation status: no concrete fix version is identified in the provided d...

Caddy Security Breach

Caddy is an open source, cross-platform HTTP/Web server from Caddy Inc. Caddy suffers from a security vulnerability that stems from being susceptible to server-side request forgery SSRF attacks via the X-Forwarded-Host header...

CVE-2023-49097: Weak Password Recovery Mechanism for Forgotten Password

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicio...

ZITADEL Authorization Issues Vulnerability

ZITADEL is a modern open source alternative to Auth0, Firebase Auth, AWS Cognito, and Keycloak built for the age of containers and serverless in the Swiss ZITADEL open source. An authorization issue vulnerability exists in ZITADEL versions prior to 2.41.6, prior to 2.40.10, and prior to 2.39.9,...

Server-side Request Forgery (SSRF)

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or...

phpIPAM Input Validation Error Vulnerability

phpIPAM is an open source PHP and MySQL based IP address management application IPAM. An input validation error vulnerability exists in phpIPAM version 1.5.1, which stems from an open redirection issue with the parameter X-Forwarded-Host...

Mozilla: DOS via cache poisoning on [developer.mozilla.org]

A vulnerability was discovered on the developer.mozilla.org website that allowed an attacker to perform a denial-of-service DoS attack by adding an "X-Forwarded-Host" header with a value causing a 404 error. The website's cache configuration allowed the error response to be saved and served to...

DEBIAN-CVE-2023-22792

A regular expression based DoS vulnerability in Action Dispatch 6.0.6.1, 6.1.7.1, and 7.0.4.1. Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process...

Kaltura mwEmbed 跨站脚本漏洞

mwEmbed is Kaltura open source a Kaltura HTML5 media library . Enables you to take advantage of HTML5 and Flash's unified configuration and development API. A cross-site scripting vulnerability exists in versions prior to Kaltura mwEmbed 2.96.rc1, which stems from some unknown processing in the...

CVE-2022-37041

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite ZCS 8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of...

PT-2022-23765 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.15 through 9.0 Description: An issue was discovered in ProxyServlet.java in the /proxy servlet. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The...

XVIDEOS: Host Header Injection Attack - www.xnxx.com

Host Header Injection Attack - www.xnxx.com An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. This header specifi...

CVE-2022-24181

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...

CVE-2022-24181

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...

Cross site scripting

Cross-site scripting XSS via Host Header injection in PKP Open Journals System 2.4.8 = 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header...